As organisations accelerate artificial intelligence (AI) adoption, fragmented, outdated, and poorly governed data may undermine its potential.
Gartner found that 63% of organisations either lack adequate data management practices to support AI or aren’t sure their practices are sufficient. This underscores the need for a trusted data foundation before scaling AI initiatives.
Lim Hsin Yin, vice-president and general managerfor ASEAN at Cohesity, explains that a trusted, secure, and recoverable data foundation is essential for scaling AI responsibly.
Reliable data as foundation
If that data is fragmented, duplicated, outdated, or poorly governed, organisations risk inaccurate outputs, inconsistent decisions, and exposure of sensitive information. Lim Hsin Yin
AI systems are only as reliable as the data they use.
“If that data is fragmented, duplicated, outdated or poorly governed, organisations risk inaccurate outputs, inconsistent decisions and the exposure of sensitive information. They may also lose visibility into data lineage, ownership and access, making it harder to explain results or demonstrate compliance,” Lim explained.
These risks are increasing as businesses integrate AI into their operations.According to Cohesity’s fifth annual Global Cyber Resilience Report, 99% of Singapore organisations use AI systems, applications, workflows, or machine learning models.
However, only 44% said their cyber response and recovery plans comprehensively address AI-targeted attacks.
Meanwhile, 55% are not well prepared to detect, contain and recover from unintended or incorrect actions by AI agents, copilots or workflows.
These gaps can amplify the consequences of errors as AI adoption expands, increasing operational, regulatory, and reputational risks. Organisations must look beyond model performance and ensure their AI data is trustworthy, secure, governed, and recoverable.
AI-ready data
AI-ready data is not data you can connect to a model; it is data you can trust, govern, protect, and recover. Lim Hsin Yin
According to Lim, “AI-ready data is not data you can simply connect to a model – it is data you can trust, govern, protect and recover.”
He encourages organisations to determine what data they have, where it resides, who owns it, its accuracy and currency, who can access it, and whether its use is approved for the intended AI application.
He added: “They should also be able to classify sensitive information, trace lineage, apply appropriate retention policies, and verify that clean, validated recovery points exist.”
He emphasised that this is especially important for unstructured enterprise data, which can be challenging to classify and govern at scale.
He added that organisations should understand the permissions associated with their data and assess whether these controls are appropriate for AI use.
“The practical test is simple: can the organisation explain why the data is trustworthy, control how it is used and restore it to a known-good state if it is compromised?”, she said.
Balancing act
“Security should enable AI innovation, not be added after deployment.” Lim Hsin Yin
It is also important to balance data accessibility for AI systems with security, privacy, compliance, and access-control requirements.
“The goal is not to give AI access to everything – it is to give it secure access to the right data for the right purpose,” Lim said.
He argued that organisations should design accessibility and control together, not treat them as opposing priorities. Data classification, role-based access, least-privilege policies, and strong identity controls can limit each AI system to the information it needs.
“Sensitive data should remain protected through encryption, monitoring, audit trails, retention rules and applicable residency requirements,” Lim reminded.
He also reminded organisations to enable governed access to trusted data and preserve existing access policies without creating unmanaged copies that increase exposure. They should also deploy tested processes to revoke access, contain misuse, and recover affected data and AI environments.
“Security should enable AI innovation, not be added after deployment,” she emphasised. “A zero-copy approach reduces exposure by enabling AI to access protected data where it resides.”
Trusted AI strategy
When building an AI strategy, organisations must prioritise data consolidation and governance.
“AI cannot deliver trusted outcomes without a trusted data foundation. That is why organisations must build data consolidation and governance into their AI strategy from the start. When data is spread across silos, duplicated or inconsistent, it is much harder to know what AI systems are using and whether that information can be trusted,” Lim posits.
He said effective data consolidation and governance become increasingly important as AI environments grow more interconnected.
According to Cohesity’s research, 71% of Singapore organisations reported moderate or significant gaps in recovery plans covering dependencies across cloud infrastructure, SaaS applications, identity services, security tools, third-party integrations and AI systems.
“Consolidation gives organisations better visibility, while governance sets clear rules around which data can be used, by whom and for what purpose,” she added.
Lim emphasised that data consolidation and governance do not require moving all data into one place. Instead, they involve consistently discovering, classifying, securing, and providing approved access to enterprise data across hybrid environments.
“The model matters, but trusted AI starts with trusted data,” she added.
Placing priorities
For organisations experimenting with AI but struggling with data chaos, Lim offers simple advice: “Don’t try to fix all your data before you start—prove one trusted, secure use case, then scale what works.”
He said it starts with gaining a clear view of the data behind that use case: what it is, where it resides, who owns it, and whether it can be trusted.
It is also vital to identify sensitive and business-critical information, then decide whether to retain, isolate, or remove redundant, outdated, or untrusted data.
“From there, organisations can establish clear access controls, create clean recovery points, and test their assumptions under real-world conditions before expanding,” she shared. She added that this process requires collaboration across IT, security, data, risk, and business departments.
“The need to build resilience early is clear,” Lim underscored.
“The aim is not to clean up the entire data estate overnight. It is to create one secure, governed, and recoverable path to a measurable AI outcome and build from there,” she concluded.
